Malicious code in fundraiserservpp (npm)
fundraiserservpp@2.0.0 on npm contained malicious code that executed a preinstall script to exfiltrate host metadata to an attacker-controlled endpoint. The package was designed to confirm successful installation in target build environments as part of a dependency-confusion reconnaissance attack.
- Disclosed
- Last updated
- Blast radius
- Any developer or build system that installed fundraiserservpp@2.0.0 from npm
- Ecosystems
- Attack vectors
- Affected entities
- fundraiserservpp · 2.0.0
fundraiserservpp@2.0.0 published on npm contained malicious code embedded in a preinstall lifecycle script. When the package was installed via npm install, the script automatically executed without user interaction.
The preinstall script collected sensitive host metadata from the installer machine, including hostname, platform, architecture, user home directory path, and configured DNS servers. This data was serialized as JSON and sent via HTTPS POST to a hardcoded Burp Collaborator subdomain (mrh99ucv1u3kyeba1020ae2t7kdc12pr.oastify.com/hit), which is an attacker-controlled out-of-band interaction endpoint.
The beacon mechanism is consistent with dependency-confusion reconnaissance tactics, allowing the attacker to confirm that the package name was successfully resolved and installed within a target build environment. The attack required no user interaction beyond the standard package installation process.
This incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- fundraiserservpp
- Domains
- mrh99ucv1u3kyeba1020ae2t7kdc12pr.oastify.com
Remediation
- Immediately uninstall fundraiserservpp@2.0.0 from all development and production environments
- Audit npm package.json and lock files for any dependency on fundraiserservpp
- Review build logs and system access logs for the time period when the package may have been installed
- Rotate credentials and secrets that may have been exposed on affected machines
- Implement package verification and scanning in CI/CD pipelines to detect malicious preinstall scripts
- Use npm audit and security scanning tools to identify other potentially compromised dependencies
- Consider using npm package lock files and integrity verification to prevent unexpected package installations
Sources
- GitHub Advisory GHSA-6gxr-mpw5-79mr · GitHub Advisory Database
Cite this entry
"Malicious code in fundraiserservpp (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-fundraiserservpp-npm-17ghfp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion